Fix unhealthy VPN recovery with cross-country failover

[eirenik0]

Summary

• add watchdog recovery settings for provider-specific fallback countries and shorter probe/control API timeouts
• make fleet rotation track structured country/city targets and preserve country metadata during failover
• enforce unique egress IP verification across healthy services and cache bad rotation IPs
• improve daemon observability with active cycle state so status no longer appears hung during long loops
• allow Gluetun control client retry settings to be overridden by watchdog health assessment

Testing

• make fmt
• make lint
• uv run pytest tests/test_agent_config.py tests/test_agent_cli.py tests/test_agent_runtime.py tests/test_fleet_state_manager.py tests/test_health_assessment.py -q